Bug 432833 - sudo password/authorization not cached when removing packages in Discover
Summary: sudo password/authorization not cached when removing packages in Discover
Status: RESOLVED UPSTREAM
Alias: None
Product: policykit-kde-agent-1
Classification: Plasma
Component: general (show other bugs)
Version: 5.18.5
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Dario Freddi
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-02-12 09:08 UTC by Dan Dascalescu
Modified: 2025-01-15 13:12 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
Screencast (2.13 MB, image/gif)
2021-02-12 09:08 UTC, Dan Dascalescu
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dan Dascalescu 2021-02-12 09:08:59 UTC
Created attachment 135615 [details]
Screencast

When removing packages from Discover one after another, I have to type my password every single time, even though no more than 10 seconds passed since the last time I typed it.


STEPS TO REPRODUCE
1. Launch Discover
2. Find some useless font to remove
3. Remove it
4. Remove the another useless font right away

OBSERVED RESULT
Discover asks for my sudo password again

EXPECTED RESULT
It should only ask for the password again if enough time has passed since the last time I entered it, as `sudo` does.
Comment 1 Nate Graham 2021-02-12 17:05:04 UTC
Hmm that's odd. It's supposed to remember the password for a few monites, but I think this may be determined by distro authentication policies. I'm using openSUSE Tumbleweed and on that distro, installing can be done without a password at all, but removing requires a password, due to distro settings. A couple of questions:

1. Which distro are you using?
2. Does this happen when you remove apps too, or just fonts?
3. Does this happen when you install apps too?
Comment 2 Aleix Pol 2021-02-15 12:54:46 UTC
No, PolKit doesn't remember the password, and so doesn't PackageKit.

Discover itself doesn't do any of the password requests.

I'll move the bug report to our polkit integration, maybe it can be done from there.
Comment 3 Aleix Pol 2021-02-15 12:55:21 UTC
Moved.
Comment 4 Harald Sitter 2025-01-15 13:12:07 UTC
I think that would need implementing in polkit directly. By the time the request reaches the agent we are already inside a pam auth flow and need to supply a finger print or 2fa token or passphrase etc.

If polkitd got some more context about app lifetime that may help here

e.g.

- discover creates a pipe
- discover sends one end of the pipe over dbus directly to polkitd
- polkitd can get discover's pid through dbus builtin API
- polkitd now has a pid and a life sign (the open pipe)
- while the pipe is open discover holds that pid and polkit could choose to reuse prior successful authentications

possibly this could even be done through either a dbus peer to peer connection or tracking dbus service names (though I think that is subject to race conditioning).

Best report this upstream to polkit for consideration.